From fd977601b63b7cbfdc92b9499fb05d47015bd9f4 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Thu, 4 Oct 2012 12:59:58 +0530 Subject: [PATCH] fix for bug #574. More of a temporary solution to prevent any possible FPs. Disable content inspection bypass for mpm patterns. --- src/detect-engine-content-inspection.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c index 6956052f14..2546f7daeb 100644 --- a/src/detect-engine-content-inspection.c +++ b/src/detect-engine-content-inspection.c @@ -116,9 +116,9 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx /* we might have already have this content matched by the mpm. * (if there is any other reason why we'd want to avoid checking * it here, please fill it in) */ - if (cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED) { - goto match; - } + //if (cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED) { + // goto match; + //} /* rule parsers should take care of this */ #ifdef DEBUG -- 2.47.3